Disclosure · Form 10-K · fiscal 2025
NN, Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed March 4, 2026· period ended December 31, 2025· NNBR· CIK 918541· Updated · filing on sec.gov ↗· company page
NN, Inc.'s Form 10-K for fiscal 2025, filed March 4, 2026, names the Chief Financial Officer as its top security role, with oversight by the Audit Committee of the Board of Directors. On CISO Tribune's record, the Chief Information Officer and Chief Information Security Officer of NN, Inc. is Gregg Cottage (appointment announced on October 1, 2025; record).
- NN, Inc.: who leads security, and the seat's history
- Gregg Cottage, Chief Information Officer and Chief Information Security Officer of NN, Inc. on our record
- How other metalworkg machinery & equipment filers describe the seat
What NN, Inc.'s Item 1C says
NN's Form 10-K for fiscal 2025 places oversight of cybersecurity risk with the Audit Committee of the Board of Directors. The filing states that the Chief Financial Officer is responsible for the management of the Company's information systems.
Board and management oversight
The Audit Committee receives updates from management on ongoing cybersecurity initiatives and events at least once per quarter. After a material cybersecurity incident, management notifies the Cybersecurity Sub-Committee of the Board of Directors, which oversees the Company's response and mitigation.
Who leads security
The Chief Financial Officer oversees the Company's information technology team, which the filing defines as the IT Team.
How the company manages cyber risk
The company has a security operations center that uses an industry standard security information and event management tool to aggregate and analyze data and provide alerts of potential breaches. The IT Team has documented procedures for cybersecurity response plans, which are reviewed annually or as events warrant. The company requires yearly cybersecurity training and conducts phish testing, including regular simulated phishing attempts. The company maintains a cybersecurity insurance policy to reduce any direct costs that could be incurred in a cybersecurity incident.
Third parties and incidents
The IT Team uses third party security experts for continuous external penetration testing, security reviews, and a managed security operations center. The company has a vendor management process to manage cybersecurity risks associated with its use of third-party service providers. The filing states that impacts of past cybersecurity incidents have been immaterial to date, while future impacts may materially and adversely affect the business.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a specific security framework or standard.
Read from the Form 10-K filed March 4, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Financial Officer
Reports to
not identified
Board oversight
Audit Committee of the Board of Directors
“The Audit Committee of the Board of Directors has oversight for the reliability and security of our information systems, including identifying material risks and cybersecurity threats arising in our business.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
Described
“The IT Team utilizes third party security experts to provide continuous external penetration testing, conduct security reviews, and to provide a managed security operations center that does regular monitoring as well as provide additional resources for threat and incident response activities.”
Experience of the security leadership, as stated
not identified
Material incident
The filing states none
“Although impacts of past cybersecurity incidents have been immaterial to date , the impacts of such events in the future may materially and adversely affect our business, financial condition, or results of operations.”
The section
684 words, Form 10-K filed March 4, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 16, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns NN, Inc. standard industrial classification 3540, Metalworkg machinery & equipment (SEC SIC list). One other filer in our library has the same code. Also shown: filers whose codes the SEC assigns to the same review office (Office of Technology).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| SPX Technologies, Inc.FY 2025, filed February 25, 2026 | chief information security officer | not identified | Audit Committee |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Tianci International, Inc.FY 2026, filed November 4, 2026 | Corporate Controller | CEO/CFO | Audit Committee |
| Brightline Interactive, Inc.FY 2026, filed September 28, 2026 | Chief Technology Officer | Chief Executive Officer | full board |
| ReposiTrak, Inc.FY 2026, filed September 28, 2026 | not identified | not identified | Audit Committee |
| DONALDSON Co IncFY 2026, filed September 25, 2026 | Chief Information Officer | not identified | audit committee |
| EGAIN CorpFY 2026, filed September 10, 2026 | Chief Information Security Officer | Chief Financial Officer | Audit Committee |
| Palo Alto NetworksFY 2026, filed September 10, 2026 | chief information security officer | not identified | Security Committee |
| Twin Disc IncFY 2026, filed September 4, 2026 | not identified | not identified | Audit Committee of the Board of Directors |
More disclosures from filers CISO Tribune files under Industrial & Energy: Phillips 66, Rockwell Automation, The Goodyear Tire & Rubber Company, Brunswick, Deere, Eversource Energy, FirstEnergy, General Motors.
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of NN, Inc.'s Form 10-K as filed with the SEC on March 4, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity
Cybersecurity Overview
We rely on proprietary and third-party information systems to process, transmit and store information and to manage or support our business processes. We store and maintain confidential financial and business information regarding us and persons with whom we do business on our information technology systems. We also collect and hold personal data of our employees in connection with their employment. In addition, we engage third-party service providers that may collect and hold personal data of our employees in connection with providing business services to us, including web hosting, accounting, payroll and benefit services.
Cybersecurity Governance
The protection of the information technology systems on which we rely is critically important to us. The Audit Committee of the Board of Directors has oversight for the reliability and security of our information systems, including identifying material risks and cybersecurity threats arising in our business. The Audit Committee receives updates from management of the ongoing cybersecurity initiatives and events at least once per quarter. In the event of a material cybersecurity incident, management will notify the Cybersecurity Sub-Committee of the Board of Directors, which will provide oversight for the Company's response and mitigation to the incident.
Our Chief Financial Officer is responsible for the management of the Company's information systems and oversees the Company's information technology team ("IT Team"). The IT Team has in place documented procedures for cybersecurity response plans, which are reviewed annually or as events warrant. The IT Team utilizes third party security experts to provide continuous external penetration testing, conduct security reviews, and to provide a managed security operations center that does regular monitoring as well as provide additional resources for threat and incident response activities.
Cybersecurity Risk Management and Strategy
We employ a multi-layered approach to protect our information systems from cybersecurity threats. We have security operations center coverage that uses an industry standard security information and event management tool to aggregate and analyze data and provide alerts of potential breaches. Hardware within our information systems run an industry-standard anti-virus solution, and we have a patching program in place to keep security updates current. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats. For example, penetration testing is conducted by an outside party on a periodic basis, resulting in rapid discovery and remediation of potential
weaknesses. To ensure employee compliance with our processes, we require yearly cybersecurity training and conduct phish testing, including regular simulated phishing attempts. Additional training is assigned to employees as deemed necessary to reduce the risk of cybersecurity threats. In case of a cybersecurity incident, we maintain a cybersecurity insurance policy to reduce any direct costs that could be incurred.
We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management process to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.
A cybersecurity incident could interrupt our operations, result in downtime, divert our planned efforts and resources from other projects, damage our reputation and brand, damage our competitive position, subject us to liability claims or regulatory penalties under laws protecting the privacy of personal information. Although impacts of past cybersecurity incidents have been immaterial to date , the impacts of such events in the future may materially and adversely affect our business, financial condition, or results of operations.
For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including " A security breach or disruption to our information technology systems, or those of the third parties with whom we work, could materially adversely affect our business, financial condition, results of operations and reputation ."
Earlier filings on record
Fiscal 2024 Form 10-K, filed March 6, 2025 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
Audit Committee of the Board of Directors
“The Audit Committee of the Board of Directors has oversight for the reliability and security of our information systems, including identifying material risks and cybersecurity threats arising in our business.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“Although impacts of past cybersecurity incidents have been immaterial to date , the impacts of such events in the future may materially and adversely affect our business, financial condition, or results of operations.”
Read by claude-sonnet-5-5 on October 16, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity
Cybersecurity Overview
We rely on proprietary and third-party information systems to process, transmit and store information and to manage or support our business processes. We store and maintain confidential financial and business information regarding us and persons with whom we do business on our information technology systems. We also collect and hold personally identifiable information of our employees in connection with their employment. In addition, we engage third-party service providers that may collect and hold personally identifiable information of our employees in connection with providing business services to us, including web hosting, accounting, payroll and benefit services.
Cybersecurity Governance
The protection of the information technology systems on which we rely is critically important to us. The Audit Committee of the Board of Directors has oversight for the reliability and security of our information systems, including identifying material risks and cybersecurity threats arising in our business. The Audit Committee receives updates from management of the ongoing cybersecurity initiatives and events at least once per quarter. In the event of a material cybersecurity incident, management will notify the Cybersecurity Sub-Committee of the Board of Directors, which will provide oversight for the Company's response and mitigation to the incident.
Our Chief Financial Officer is responsible for the management of the Company's information systems and oversees the Company's information technology team ("IT Team"). The IT Team has in place documented procedures for cybersecurity response plans, which are reviewed annually or as events warrant. The IT Team utilizes third party security experts to provide continuous external penetration testing, conduct security reviews, and to provide a managed security operations center that does 24/7 monitoring as well as provide additional resources for threat and incident response activities.
Cybersecurity Risk Management and Strategy
We employ a multi-layered approach to protect our information systems from cybersecurity threats. We have around the clock security operations center coverage that uses an industry leading security information and event management tool to aggregate and analyze data and provide immediate alerts of potential breaches. All hardware within our information systems run an industry-standard anti-virus solution, and we have an established patching program in place to keep security updates current. Penetration testing is conducted by an outside party on a continual basis, resulting in rapid discovery and remediation of potential weaknesses. To ensure employee compliance with our processes, we require yearly cybersecurity training and conduct phish testing, including simulated phishing attempts, multiple times per month. Additional training is assigned to employees as deemed necessary to reduce the risk of cybersecurity threats. In case of a cybersecurity incident, we maintain a cybersecurity insurance policy to reduce any direct costs that could be incurred.
A cybersecurity incident could interrupt our operations, result in downtime, divert our planned efforts and resources from other projects, damage our reputation and brand, damage our competitive position, subject us to liability claims or regulatory penalties under laws protecting the privacy of personal information. Although impacts of past cybersecurity incidents have been immaterial to date , the impacts of such events in the future may materially and adversely affect our business, financial condition, or results of operations.
Fiscal 2023 Form 10-K, filed March 12, 2024 sec.gov ↗
Top security role, as the filing names it
Chief Financial Officer
Reports to, as the filing names it
not identified
Board oversight
Audit Committee of the Board of Directors
“The Audit Committee of the Board of Directors has oversight for the reliability and security of our information systems, including identifying material risks and cybersecurity threats arising in our business.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“Although impacts of past cybersecurity incidents have been immaterial to date, the impacts of such events in the future may materially and adversely affect our business, financial condition, or results of operations.”
Read by claude-sonnet-5-5 on October 16, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity
Cybersecurity Overview
We rely on proprietary and third-party information systems to process, transmit and store information and to manage or support our business processes. We store and maintain confidential financial and business information regarding us and persons with whom we do business on our information technology systems. We also collect and hold personally identifiable information of our employees in connection with their employment. In addition, we engage third-party service providers that may collect and hold personally identifiable information of our employees in connection with providing business services to us, including web hosting, accounting, payroll and benefit services.
Cybersecurity Governance
The protection of the information technology systems on which we rely is critically important to us. The Audit Committee of the Board of Directors has oversight for the reliability and security of our information systems, including identifying material risks and cybersecurity threats arising in our business. The Audit Committee receives updates from management of the ongoing cybersecurity initiatives and events at least once per quarter. In the event of a material cybersecurity incident, management will notify the Cybersecurity Sub-Committee of the Board of Directors, which will provide oversight for the Company's response and mitigation to the incident.
Our Chief Financial Officer is responsible for the management of the Company's information systems and oversees the Company's information technology team ("IT Team"). The IT Team has in place documented procedures for cybersecurity response plans, which are reviewed annually or as events warrant. The IT Team utilizes third party security experts to provide continuous external penetration testing, conduct security reviews, and to provide a managed security operations center that does 24/7 monitoring as well as provide additional resources for threat and incident response activities.
Cybersecurity Risk Management and Strategy
We employ a multi-layered approach to protect our information systems from cybersecurity threats. We have around the clock security operations center coverage that uses an industry leading security information and event management tool to aggregate and analyze data and provide immediate alerts for any breaches. All hardware within our information systems run an industry-standard anti-virus solution, and we have an established patching program in place to keep security updates current. Penetration testing is conducted by an outside party on a continual basis, resulting in rapid discovery and remediation of any potential weaknesses. To ensure employee compliance with our processes, we require yearly cybersecurity training and conduct phish testing, including simulated phishing attempts, multiple times per month. Additional training is assigned to employees as deemed necessary to reduce the risk of cybersecurity threats. In case of a cybersecurity incident, we maintain a cybersecurity insurance policy to reduce any direct costs that could be incurred.
A cybersecurity incident could interrupt our operations, result in downtime, divert our planned efforts and resources from other projects, damage our reputation and brand, damage our competitive position, subject us to liability claims or regulatory penalties under laws protecting the privacy of personal information. Although impacts of past cybersecurity incidents have been immaterial to date, the impacts of such events in the future may materially and adversely affect our business, financial condition, or results of operations.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.